RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-12-26 01:02:33 +00:00
Code Issues Projects Releases Wiki Activity

avformat/mov: Check ctts_count before use

Browse Source 
Fixes out of array read
Fixes: asan_heap-oob_ae74b5_3610_cov_1739568095_test.3g2

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2015-02-25 13:00:51 +01:00
parent 1f5c7781e6
commit bbbc8c6188
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavformat/mov.c
View File

@ -4191,7 +4191,11 @@ static AVIndexEntry *mov_find_next_sample(AVFormatContext *s, AVStream **st)
if (msc->pb && msc->current_sample < avst->nb_index_entries) { if (msc->pb && msc->current_sample < avst->nb_index_entries) {
AVIndexEntry *current_sample = &avst->index_entries[msc->current_sample]; AVIndexEntry *current_sample = &avst->index_entries[msc->current_sample];
int64_t dts; int64_t dts;
if (msc->ctts_data)
if (msc->ctts_data && msc->ctts_index >= msc->ctts_count)
av_log(s, AV_LOG_WARNING, "CTTS list too small\n");
if (msc->ctts_data && msc->ctts_index < msc->ctts_count)
dts = av_rescale(current_sample->timestamp - msc->dts_shift - msc->ctts_data[msc->ctts_index].duration, dts = av_rescale(current_sample->timestamp - msc->dts_shift - msc->ctts_data[msc->ctts_index].duration,
AV_TIME_BASE, msc->time_scale); AV_TIME_BASE, msc->time_scale);
else else